CVE-2006-1785 - Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrar

CVE-2006-1785

Summary

Adobe Document Server for Reader Extensions 6.0 allows remote authenticated users to inject arbitrary web script via a leading (1) ftp or (2) http URI in the ReaderURL variable in the "Update Download Site" section of ads-readerext. NOTE: it is not clear whether the vendor advisory addresses this issue. In addition, since the issue requires administrative privileges to exploit, it is not clear whether this crosses security boundaries.

References

Vulnerable Configurations

cpe:2.3:a:adobe:document_server:6.0:*:reader_extensions:*:*:*:*:*
cpe:2.3:a:adobe:document_server:6.0:*:reader_extensions:*:*:*:*:*

CVSS

Base:	2.1 (as of 18-10-2018 - 16:36)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:H/Au:S/C:N/I:P/A:N

refmap via4

bid	17500
bugtraq	20060413 Secunia Research: Adobe Document Server for Reader ExtensionsMultiple Vulnerabilities
misc	http://secunia.com/secunia_research/2005-68/advisory/ http://www.adobe.com/support/techdocs/322699.html
osvdb	24588
secunia	15924
vupen	ADV-2006-1342
xf	adobe-readerurl-xss(25770)

Last major update

18-10-2018 - 16:36

Published

13-04-2006 - 22:02

Last modified

18-10-2018 - 16:36